SDN-based Intelligent Honeynet Architecture for Averting Attacks

The current Honeypots are not flexible enough to respond to different types and intensities of cyber attacks. A variety of SDN-based architectures is used with honeynet technologies to reduce threats. This paper proposes a Software Defined Network(SDN)-based Intelligent Honeynet Architecture (SIHA) to solve the problem of the inflexibility of conventional honeynets inside the organizational network scenario. The new architecture of the SIHA is agile enough to alleviate the attacks by migrating them to several sensitized honeypots designed with specific capabilities and purposes. Integration of low and medium-interaction honeypots with a real-time SDN setup is efficacious to circumvent the attacks at the production level of the organization and do a reckoning about the adversaries. The proposed solution can manage traffic intelligently instead of sending packets to the target host, it diverts the malicious traffic to the honeypot for further analysis by allowing only clean traffic to the desired destination. Finally, the experimental environment setup using a real-time SDN testbed, Suricata, and different honeypot sensors, including Supervisory Control and Data Acquisition (SCADA), My Structured Query Language (MySQL) the database server, Server Message Block (SMB) server, Secured Shell (SSH) server, Teletype Network (TELNET) server, and File Transfer Protocol (FTP) server honeypots at the production level and in the internal network for validation of attack classification and migration module of SIHA. The results reveal that SIHA is more productive than traditional honeynet in capturing threats related to these services—Modbus, MySQL, SMB, SSH, Telnet, and FTP and creating a secure network environment inside an organization.